InfoSecBulletin Cybersecurity for mankind
Microsoft has released patches for two critical security flaws in Azure AI Face Service and Microsoft Account that could allow an attacker to escalate their privileges.
The flaws are listed below:
YouTube geo-blocks at least 4 Bangladeshi TV channels in India
Microsoft Patches Four Critical Azure and Power Apps Vulns
Qilin Ransomware topped April 2025 with 45+ data leak disclosures
SonicWall Patches 3 Flaws in SMA 100 Devices
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed
Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA
CVE-2025-29824
Play Ransomware Exploited Windows CVE-2025-29824 as Zero-Day
Hacker exploited Samsung MagicINFO 9 Server RCE flaw
CISA adds Langflow flaw to its KEV catalog
Google Fixes Android Flaw (CVE-2025-27363) Exploited by Attackers
CVE-2025-21396 (CVSS score: 7.5) – Microsoft Account Elevation of Privilege Vulnerability
CVE-2025-21415 (CVSS score: 9.9) – Azure AI Face Service Elevation of Privilege Vulnerability
“Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network,” Microsoft in an advisory for CVE-2025-21415, crediting an anonymous researcher for reporting the flaw.
CVE-2025-21396 is a security vulnerability caused by a lack of authorization, allowing unauthorized users to gain elevated privileges on a network. It was discovered by security researcher Sugobet.
The tech giant acknowledged a proof-of-concept exploit for CVE-2025-21415 but confirmed that both vulnerabilities have been fully addressed, requiring no action from customers.
Microsoft is improving transparency by issuing CVEs for critical cloud service vulnerabilities, regardless of whether customers need to apply a patch or take other actions for security.
“As our industry matures and increasingly migrates to cloud-based services, we must be transparent about significant cybersecurity vulnerabilities that are found and fixed,” it noted back in June 2024.
“By openly sharing information about vulnerabilities that are discovered and resolved, we enable Microsoft and our partners to learn and improve. This collaborative effort contributes to the safety and resilience of our critical infrastructure.”
